From https://github.com/livingstonetech/providence

Kernel based auditing for Mac, BSD and Linux. Leverages the Audit Subsystem, OpenBSM (eventually) and Apple’s Endpoint Security Framework